Bump Go toolchain to 1.27.2 and x/crypto to v0.58.0

Clears 9 reachable stdlib govulncheck findings (all fixed in go1.27.2).
Remaining: GO-2026-5932 (x/crypto/openpgp, module-level only, no fix
available; our code does not call it).

Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1
 
 # ---- build stage ----
-FROM golang:1.27-alpine AS build
+FROM golang:1.27.2-alpine AS build
 WORKDIR /src
 
 # cache deps first